What is the best way to get data into AX from a separate SQL database?

[ATrain]

We have a separate SQL database that we need to pull information from into AX. Right now, we are using direct SQL calls from X++. I’m very nervous that it leaves us completely open to SQL injection attacks. Is there an alternative, or a good way to sanitize the data?

We are doing something like:

sqlStatement = ‘select * from customTable’;

sqlStatementExecutePermission = new SqlStatementExecutePermission(sqlStatement);

sqlStatementExecutePermission.assert();

resultSet = statement.executeQuery(sqlStatement);

[kranthi]

look into these links

http://msdn.microsoft.com/en-us/library/aa600196.aspx

http://msdn.microsoft.com/en-us/library/ee677510.aspx

[ATrain]

look into these links

http://msdn.microsoft.com/en-us/library/aa600196.aspx

http://msdn.microsoft.com/en-us/library/ee677510.aspx

That is what we are doing now, I was hoping for an alternative such as .Net’s LINQ (Language integrated query).

The connection.createStatement is vulnerable to SQL injection attacks without sanitation and I’m not a big fan of long SQL strings of text in AX. See here for what worries me:

A SQL injection threat is posed when you use the createStatement method to create a SQL statement and then allow a user to control input to the statement.

http://msdn.microsoft.com/en-us/library/aa600674.aspx